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Field of the Invention 

This invention relates to secure document printing systems. More 
5 particularly, this invention is directed to a postage metering system including a 
printer having dual print heads, one secure and one non-secure, for printing a 
verifiable postal indicium. 



Background of the Invention 

One example of a document printing system is a postage metering 

10 system. As is well known, a postage meter is basically an accounting device that 
securely stores and keeps track of an amount of postage available for printing. 
Typically, the postage meter includes an ascending register that stores a running 
total of all postage dispensed by the meter, and a descending register, that holds 
the remaining amount of postage credited to the meter and that is reduced by 

1 5 the amount of postage dispensed during a transaction. The postage meter 
generally also includes a control sum register that provides a check upon the 
descending and ascending registers. The control sum register has a running 
account of the total amount of funds that have been added into the meter. The 
control sum register must always correspond with the summed readings of the 

20 ascending and descending registers. Thus, the control sum register is the total 
amount of postage ever put into the machine and it is alterable only when adding 
funds to the meter. In this manner, by inspecting the various registers and 
securing them from tampering, the dispensing of postal funds may be accurately 
recorded, tracked and accounted for. 

25 Traditionally, the postage meter and the printer have been incorporated 

into a single secure housing. However, recent initiatives by the United States 
Postal Service (USPS) have enabled the decoupling of the postage meter and 
the printer. The Information-Based Indicia Program (IBIP) is a distributed trusted 
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system established by the USPS to retrofit and augment existing postage meters 
using new technology known as information-based indicia. The IBIP relies on 
digital signature techniques to produce for each mail piece an indicium whose 
origin cannot be repudiated. Thus, in contrast to traditional postage metering 
5 systems employing mechanical printing technology and physical security, the 
IBIP supports new methods of securely applying postage to mail pieces. 
Generally, the IBIP requires printing a high density two-dimensional (2D) bar 
code on a mail piece. The 2D barcode encodes various information associated 
with the mail piece and is subsequently signed with a digital signature. 

10 The USPS has published detailed specifications for the IBIP. Generally, 

the IBIP is directed to two types of postage metering systems. The first type is 
referred to as a closed system and is defined in the INFORMATION BASED 
INDICIA PROGRAM - PERFORMANCE CRITERIA FOR INFORMATION- 
BASED INDICIA AND SECURITY ARCHITECTURE FOR CLOSED IBI 

15 POSTAGE METERINGS SYSTEMS, dated January 12, 1999, ("IBIP Closed 

System Specification"). The second type is referred to as an open system and is 
defined in the INFORMATION BASED INDICIA PROGRAM - PERFORMANCE 
CRITERIA FOR INFORMATION-BASED INDICIA AND SECURITY 
ARCHITECTURE FOR OPEN IBI POSTAGE EVIDENCING SYSTEMS, dated 

20 February 23, 2000, ("IBIP Open System Specification"). Together, the IBIP 

Closed System Specification and the IBIP Open System Specification define the 
requirements for next generation postage metering systems. 

Although the open and closed postage metering systems both work 
generally well, they suffer from certain drawbacks and disadvantages. The IBIP 

25 Open System Specification allows customers to use a generic "off the shelf 
printer. As a result, these types of postage metering systems typically cost less 
because the customer is able to reuse its general office printer for printing 
postage. However, the IBIP Open System Specification requires that the 
recipient address (in the form of a delivery point zip code) be included in the 

30 postal indicium. This forces customers to input the destination address (either 
by hand or from a database) every time they want to print postage so that the 
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recipient address and the corresponding postage indicium are generated and 
printed together as an integral unit This is to ensure that address cleansing is 
performed and that there is a one to one correspondence between the recipient 
address and its associated postage indicium. As a result, the open system type 
5 of postage metering system must print this unit on the actual mail piece or label 
stock for later attachment to the mail piece. 

On the other hand, the IBIP Closed System Specification do not require 
the delivery point zip code, but do require that the printer be a dedicated postage 
printing device. Thus, these types of postage metering systems allow for quicker 

10 transaction times for the customer (no need to input the recipient address, 
perform address hygiene or print the address) but cost more for the customer 
because of the investment necessary in a dedicated postage printer that has 
limited or no usefulness other than as a postage printing appliance. 

Therefore, there is a need for a postage metering system that combines 

15 the operational efficiencies of a closed system meter with the cost advantages of 
an open system meter while satisfying the IBIP Specifications. 



Summary of the Invention 

Accordingly, it is an object of the present invention to provide a postage 
metering system with closed system type meter functionality within an affordable 

20 cost structure. 

In accomplishing this and other objects there is provided a postage 
metering system including a computer, an authentication unit, a printer and a 
control system. The control system is in operative communication with the 
computer, the authentication unit and the printer. The authentication unit and 

25 the printer are both in operative communication with the computer. The printer 
includes an unsecure print head and a secure print head. The control system: (i) 
executes a transaction session between the computer and the authentication 
unit to generate postal data to be included in a postal indicium where the postal 
indicium includes non-authorization data; (ii) initiates a print request to print the 
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postal indicium; and (iii) controls the unsecure print head to print the non- 
authorization data and the secure print head to print . 

Additionally, there is provided a general purpose secure document printer 
and methods of operating the postage metering system and the general purpose 
5 secure document printer, respectively, that are generally analogous to the 
summary provided above. 

Therefore, it should now be apparent that the invention substantially 
achieves all the above objects and advantages. Additional objects and 
advantages of the invention will be set forth in the description which follows, and 
1 0 in part will be obvious from the description, or may be learned by practice of the 
invention. Moreover, the objects and advantages of the invention may be 
realized and obtained by means of the instrumentalities and combinations 
particularly pointed out in the appended claims. 



Brief Description of the Drawings 

15 The accompanying drawings, which are incorporated in and constitute a 

part of the specification, illustrate presently preferred embodiments of the 
invention, and together with the general description given above and the detailed 
description of the preferred embodiments given below, serve to explain the 
principles of the invention. As shown throughout the drawings, like reference 

20 numerals designate like or corresponding parts. 

Fig. 1 is a schematic representation of a postage metering system 
including a personal computer, an authentication unit and a printer in accordance 
with the present invention. 

Fig. 2 is a schematic representation of the postage metering system of 

25 Fig. 1 showing the printer in greater detail in accordance with the present 
invention. 

Fig. 3 is an example of a postal indicium printed by the postage printing 
system of the present invention. 
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Figs. 4 and Fig. 5 are flow charts depicting the operation of a first print 
head and a second print head of the printer to produce the postal indicium in 
accordance with the present invention. 



Detailed Description of the Preferred Embodiments 

5 Referring to Fig. 1 , a postage metering system 100 for printing a postal 

indicium 30 on a mail piece 20 (envelope, post card, label, or the like) is shown. 
The postage metering system 100 includes a personal computer 120, an 
authentication unit 130 and a printer 140. The authentication unit 130 may be a 
postal security device (PSD), other trusted accounting unit or a secure account 

10 file located on a remote server. Referring to Fig. 2 in view of Fig.1 , a more 
detailed schematic of the printer 140 is shown. Generally, the personal 
computer 120 is in operative communication with both the authentication unit 
130 and the printer 140. The personal computer 120 may be of any 
conventional type and includes suitable computer processing, input/output 

15 devices and application programs. The printer 140 accepts print requests from a 
computer 120 using a standard print language (e.g., PCL, postscript) and 
processes print requests from the computer just as any standard printer. 
However, the printer 140 may also be used to print secure documents (e.g,, 
postal indicia, legal documents). That is, the printer 140 prints both secure and 

20 unsecured documents, and the authentication unit 130 provides authentication 
services for enabling the printer 140 to print secure documents, such as the 
postal indicium 30. Although the authentication unit 130 is depicted as 
connected to the personal computer 120 and external to both the personal 
computer 120 and printer 140, it may be embedded in either the personal 

25 computer 120 or the printer 140. However, in the most preferred embodiment, 
the authentication unit 130 is located at a data center (remote server - not 
shown) that is accessible by the personal computer 120 over a suitable 
communication network, such as: a local area network, a wide area network, the 
Internet or the like. 
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The printer 140 includes a communication interface 142, a printer user 
interface 144, a printer controller 146, a first print head 148 and a second print 
head 150. The communication interface 142 manages the communications 
between the personal computer 120 and the printer controller 146. The printer 
5 user interface 144 is operatively connected to the printer controller 146 and may 
be of any conventional type, such as: LCD and keypad, or the like, for 
communicating message to and receiving instructions from the operator. The 
printer controller 146 may be of any conventional type, such as: a suitable 
microprocessor device having associated hardware and software applications, 

10 for controlling the operation of the printer 140. The first print head 148 is an "off 
the shelf printing device (unsecure) and may employ any conventional printing 
technology, such as: laser, thermal transfer or ink jet printing. On the other 
hand, the second print head 150 is a secure printing device employing any 
conventional printing technology. This may be accomplished by integrating into 

15 the second print head 150 a secure chip or processor 152 for communicating 
with the authentication unit 130. While the first print head 148 is used for 
printing unsecure documents, the second print head 150 prints secure 
information and will only print after proper authentication with the authentication 
unit 130. 

20 Proper authentication between the second print head 150 and the 

authentication unit 130 is necessary to provide for security of postal funds and to 
prevent fraud. Generally, this may be accomplished through any variety of 
techniques, such as supplying the second print head 150 and the authentication 
unit 130 with secret cryptographic keys which are necessary for mutual 

25 authentication to ensure that: (i) authentication unit 130 will only transmit 

authentication information to a second print head 150; and (ii) the second print 
head 150 will only print authentication information received from a valid 
authentication unit 130. Generally, a mutual authentication routine involves the 
encryption and decryption of secret messages transmitted between the second 

30 print head 150 and the authentication unit 130. An example of such a routine 
can be found in US Patent Application Serial Co./No. 08/864,929, filed on May 



-6- 



i 



29, 1997, and entitled SYNCHRONIZATION OF CRYPTOGRAPHIC KEYS 
BETWEEN TWO MODULES OF A DISTRIBUTED SYSTEM, incorporated 
herein by reference, now issued as US Patent No. 6,064,989. However, since 
the exact routine for mutual authentication is not necessary for an understanding 
5 of the present invention, no further description is necessary. 

Referring to Fig. 3 in view of Figs. 1 and 2, an example of a postal 
indicium 30 is shown. Generally, the postal indicium 30 includes both fixed data 
that does not change from indicium to indicium and variable data that may 
change. The fixed and variable data may change depending upon postal 

10 authority requirements and the needs of the postage system manufacturer, but 
generally can be summarized as follows. The fixed data includes a graphic 
design 31 (an eagle with stars and US POSTAGE), a meter serial number 32 
uniquely identifying the authentication unit 130 and/or the second print head 150, 
a licensing post office ID (Zip Code) 33 and an optional facer identification mark 

15 (FIM) 34 used during post office processing. The variable data includes a date 
35 indicating when the postage was dispensed, a postal value 36 indicating an 
amount of postage, a bar code 37 containing both elements of both fixed and 
variable data and, in the most preferred embodiment, authentication information 
38. The bar code 37 may be of any conventional format and is provided for the 

20 purpose of improving machine readability and increasing automated processing 
of the mail piece 20. Generally, the authentication information 38 is an 
encrypted message, such as a digital signature, digital token or other data, 
derived from the information contained with the postal indicium 30. The 
authentication information 38 may be in any format, such as: alphanumeric 

25 string, bar code or the like. Most preferably, the authentication information 38 is 
incorporated into the bar code 37. Using the authentication information 38 and 
other data contained within the postal indicium 30, the postal authority can verify 
the authenticity of the postal indicium 30 using conventional techniques. Thus, 
the postal indicium 30 may also be classified as containing authentication 

30 information 38 and non-authentication information 31-37. 
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However, those skilled in the art will now recognize that since the purpose 
of the second print head 150 is to provide forensic evidence (not necessarily 
authentication information 38) of the authenticity (i.e., it is not a copy) of the 
postal indicium 30, other techniques may be employed. Thus, other evidence of 
5 authenticity besides the authentication information 38 may be used. In this 
embodiment, the first print head 148 would print the authentication information 
38. The second print head 150 need not be a high-resolution print head but may 
employ hard to reproduce properties (e.g., special ink, dynamic image tells, non- 
standard dot pitch, non-uniform dot pitch) to provide such forensic evidence. 

10 Since the second print head 150 does not need to be high resolution (or even 
high quality) it can be added to the printer 140 relatively inexpensively. Although 
it would be possible to print the entire postal indicium 30 image with the second 
print head 150, this would place stringent print quality requirements on the image 
produce by the second print head 150, increasing its cost. Therefore, the first 

15 print head 148 is used to print the bulk of the desired image while the second 
print head 150 prints forensic evidence. Because of this division of labor, the 
second print head 150 need not produce a "high quality" image and can be 
relatively inexpensive. 

The forensic evidence printed by the second print head 150 may be 

20 simple or complex depending upon application requirements. For example, the 
forensic evidence may be simply produced by using a specialized ink formulation 
(e.g., using fluorescent ink). Another alternative is to mount the second print 
head 150 in a manner (e.g., on a particular angle) which produces a hard to 
reproduce print density which can be detected by examination or by automated 

25 spectral analysis of the image. This alternative can also be extended by 
changing the orientation (even slightly) of the second print head 150 during 
printing. Orientation changes may be accomplished by moving the second print 
head 150 itself or by properties of the paper transport (e.g., varying the paper 
speed while keeping the printing speed of the second print head 150 constant). 

30 Yet another alternative is to introduce tells into the image printed by the second 
print head 150. One method of introducing tells into the image is by selectively 
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omitting small portions of the image (individual print head dots) printed by the 
second print head 150 in a specific pattern. Another method is to have the first 
print head print 148 substantially all of the postal indicium 30 while the second 
print head 150 prints a pattern of seemingly random dots throughout the postal 
5 indicium 30. These examples of forensic evidence employing unique print 
patterns could be discerned for their significance by examination or by an 
automated image processing system. The unique print patterns may be unique 
to the second print head 150 and/or unique to each postal indicium 30, 
depending upon the degree of security desired. 

10 Those skilled in the art will now recognize that the authentication unit 130 

and the printer controller 146 may employ any suitable combination of computer 
processing, input/output devices and application programs. Furthermore, 
working cooperatively the computer 120, the authentication unit 130 the printer 
controller 146 and the second print head 150 serve as a control system for 

1 5 executing the functions described in greater detail below. 

With the structure of the present invention described as above, the 
operational characteristics will now be described with respect to a typical printing 
cycle initiated by the operator. For the sake of clarity, it is assumed that the 
operator desires to print a postal indicium 30, as one example of a secured 

20 document. Additionally, the description provided below is of the most preferred 
embodiment where the second print head prints the authentication information 
38. Referring primarily to Figs. 4 and 5 while referencing the structure of Figs. 1, 
2 and 3, respective flow charts of the operation of the first print head 148 and the 
second print head 150 in accordance with the present invention are shown. 

25 In the most preferred embodiment, all print instructions distributed to both 

the first print head 148 and the second print head 150 by the print controller 146 
are dependent upon proper authorization from the second print head 150. Thus, 
every printing operation includes a reconciliation of print requests by the print 
controller 146 with the second print head 150 where the print requests are 

30 received from the computer 120. This reconciliation is described in greater detail 
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below with respect to a reconciliation routine 400 and a first print head execution 
routine 500. 

At 402, the reconciliation routine 400 idles or waits until the print controller 
146 receives a print request. The print request is transmitted to the printer 140 
5 via the computer 120. Those skilled in the art will recognize that any 
conventional transaction session between the computer 120 and the 
authentication unit 130 may be utilized to initiate the print request That is, the 
computer 120 typically contacts the authentication unit 130, a postage amount is 
determined and postal data necessary to print a valid postal indicium 130 is 

10 generated by the authentication unit 130. One example of a more detailed 
description concerning this process is found in United States Patent No. 
6,064,993, filed on December 18, 1997 and entitled CLOSED SYSTEM 
VIRTUAL POSTAGE METER, the disclosure of which is specifically incorporated 
herein by reference. Once a print request is received, at 404, a determination is 

15 made whether or not the print request is for a secure document. If the answer is 
no, then at 406 a signal is generated that indicates that the first print head 148 
may print. Thus, when an unsecure print request is received, the reconciliation 
routine 400 terminates almost immediately and control passes to the first print 
head execution routine 500, to be discussed in greater detail below. On the 

20 other hand, if at 404 the answer is yes, then the print request is for a secure 
document and at 408 mutual authentication is initiated between the 
authentication unit 130 and the second print head 150. Next, at 410 a 
determination is made whether or not the mutual authentication was successful 
(the authentication unit 130 and the second print head 150 recognize each other 

25 as being valid devices). If the answer is no, then at 412 a signal is generated 
that indicates that the first print head 148 may not print. As a result, the first print 
head execution routine 500 does not execute properly and the routine 400 does 
not proceed past step 412. Thus, a failed mutual authentication in response to a 
secure print request preferably terminates the entire printing process. That is, 

30 the first print head 148 is not allowed to print the non-authentication information 
31-37 and the second print head 150 is not allowed to print the authentication 
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information 38. On the other hand, if at 410 the answer is yes, then at 414 a 
signal is generated that indicates that the first print head 148 may print. Next, at 
416 the second print head 150 is allowed to print the authentication information 
38 by receiving appropriate print control signals from the printer controller 146. 

The first print head execution routine 500 will now be described. At 502, 
the routine 500 idles or waits until the print controller 146 receives a print 
request. Once a print request is received, at 504, a determination is made 
whether or not a signal indicating that the first print head 148 may print has been 
generated. If the answer is no, then at 506 an error signal is generated and the 
first print head 148 does not print. On the other hand, if at 504 the answer is 
yes, then at 508 the first print head 148 is allowed to print the non-authentication 
information 31-37. 

Those skilled in the art will now recognize that the present invention 
substantially addresses the drawbacks and disadvantages associated with the 
prior art discussed above. For example, since the printer 140 is not dedicated to 
only printing secure documents (postal indicium 30), the customer gets the 
benefit of leveraging the investment in a generic printer. As another example, 
since the postage metering system 100 qualifies as a closed system type meter, 
the requirement for the operator to input the destination address is eliminated. 
This reduces transaction time for the operator. As yet another example, the 
second print head 150 can be relatively inexpensive since it does not have to 
produce high quality (dot density) images. 

Additionally, various extensions to the most preferred embodiment may be 
employed. For example, the second print head 150 may use invisible ink to 
provide another layer of security to the evidence of authenticity. As another 
example, a first color ink may be used in the first print head 148 and a second 
color ink in the second print head 150. Among other things, this allows 
integrating the printing of the non-authentication information 31-37 with the 
evidence of authenticity to form a three dimensional bar code. As still another 
example, the ink in the second print head 150 may be applied to the mail piece 
20 first as a "background" for the non-authentication information 31-37. In this 



way, the contrast between the "background" and the image printed by the first 
print head 146 is improved which leads to greater readability of the non- 
authentication information 31-37. As yet still another example, the 
manufacturing process of the second print head 150 (e.g., use wide tolerances) 
5 may be varied so that the population of second print heads 1 50 print differently in 
a unique way. Thus, a catalog of the "fingerprint" of each of the second print 
heads 150 may be developed to aid in forensic analysis. 

Those skilled in the art will recognize that various modifications can be 
made without departing from the spirit of the present invention. For example, the 

1 0 exact configuration of the control system is subject to wide variety. The 

functionality may be distributed among the computer 120, the authentication unit 
130, the printer controller 146 and the second print head 150 wherever it is 
convenient to do so. As another example, the description above has been 
provided with respect to a postage metering system 100 but is equally applicable 

15 to printing any secure document (text based letter, image, etc.). Thus, those 
skilled in the art will recognize that a first print head may print the "content" of the 
document while the second print head prints the forensic evidence that 
authenticates the document content. 

Therefore, the inventive concept in its broader aspects is not limited to the 

20 specific details of the preferred embodiment but is defined by the appended 
claims and their equivalents. 
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What is Claimed is: 

1 . A postage metering system, comprising: 
a computer; 

an authentication unit in operative communication with the computer; 
a printer in operative communication with the computer, the printer 

including an unsecure print head and a secure print head; and 
a control system in operative communication with the computer, the 
authentication unit and the printer, the control system for: 
executing a transaction session between the computer and the 
authentication unit to generate postal data to be included in 
a postal indicium, the postal indicium including non- 
authorization data; 
initiating a print request to print the postal indicium; and 
controlling the unsecure print head to print the non-authorization 
data and the secure print head to print forensic evidence of 
the authenticity of the postal indicia. 

2. The postage metering system of claim 1 , wherein: 

the postal indicium further includes authorization data; and 
the forensic evidence of the authenticity of the postal indicia is the 
authorization data. 

3. The postage metering system of claim 2, wherein: 
the control system is further for: 

preventing printing by the first print head until an appropriate signal 
is generated by the second print head. 

4. The postage metering system of claim 3, wherein: 
the control system is further for: 
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initiating a mutual authentication routine between the second print 

head and the authentication unit; and 
preventing printing by the second print head if the mutual 

authentication is unsuccessful. 

5. The postage metering system of claim 1 , wherein: 

the postal indicium further includes authorization data printed by the 

unsecure print head; and 
the forensic evidence of the authenticity of the postal indicia is a unique 

print pattern. 

6. The postage metering system of claim 5, wherein: 

the unique print pattern is a tell that is embedded within the postal 
indicium. 

7. The postage metering system of claim 6, wherein: 
the control system is further for: 

preventing printing by the first print head until an appropriate signal 
is generated by the second print head. 

8. The postage metering system of claim 7, wherein: 
the control system is further for: 

initiating a mutual authentication routine between the second print 

head and the authentication unit; and 
preventing printing by the second print head if the mutual 

authentication is unsuccessful. 

9. A method of operating a postage metering system to print a postal 
indicium having non-authentication data, the method comprising the step(s) of: 
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executing a transaction session between a computer and an 

authentication unit to generate postal data to be included in the 
postal indicium; 

transmitting a print request to a printer to print the postal indicium, the 

printer including an unsecure print head and a secure print head; 
printing the non-authorization data with the unsecure print head; and 
printing forensic evidence of the authenticity of the postal indicia with the 
secure print head. 

The method of claim 9, wherein: 
the postal indicium further includes authorization data; and 
the forensic evidence of the authenticity of the postal indicia is the 
authorization data. 

The method of claim 10, further comprising the step(s) of: 
preventing printing by the first print head until an appropriate signal is 
generated by the second print head. 

The method of claim 1 1 , further comprising the step(s) of: 

initiating a mutual authentication routine between the second print head 

and the authentication unit; and 
preventing printing by the second print head if the mutual authentication is 

unsuccessful. 

The method of claim 9, wherein: 

the postal indicium further includes authorization data printed by the 

unsecure print head; and 
the forensic evidence of the authenticity of the postal indicia is a unique 

print pattern. 
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14. The method of claim 13, wherein: 

the unique print pattern is a tell that is embedded within the postal 
indicium. 

1 5. The method of claim 14, further comprising the step(s) of: 
preventing printing by the first print head until an appropriate signal is 

generated by the second print head. 

1 6. The method of claim 7, further comprising the step(s) of: 

initiating a mutual authentication routine between the second print head 

and the authentication unit; and 
preventing printing by the second print head if the mutual authentication is 

unsuccessful. 

17. A document printing system, comprising: 
a computer; 

an authentication unit in operative communication with the computer; 
a printer in operative communication with the computer, the printer 

including an unsecure print head and a secure print head; and 
a control system in operative communication with the computer, the 
authentication unit and the printer, the control system for: 
executing a transaction session between the computer and the 

authentication unit to generate document data to be included 
in a document, the document data including content data; 
initiating a print request to print the document; and 
controlling the unsecure print head to print the content data and the 
secure print head to print forensic evidence of the 
authenticity of the document. 
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18. The document printing system of claim 17, wherein: 

the document data further includes authorization data; and 
the forensic evidence of the authenticity of the document is the 
authorization data. 

1 9. The document printing system of claim 1 8, wherein: 
the control system is further for: 

preventing printing by the first print head until an appropriate signal 
is generated by the second print head. 

20. The document printing system of claim 19, wherein: 
the control system is further for: 

initiating a mutual authentication routine between the second print 

head and the authentication unit; and 
preventing printing by the second print head if the mutual 

authentication is unsuccessful. 

21. The document printing system of claim 17, wherein: 

the document data further includes authorization data printed by the 

unsecure print head; and 
the forensic evidence of the authenticity of the document is a unique print 

pattern. 

22. The document printing system of claim 21 , wherein: 

the unique print pattern is a tell that is embedded within the document. 

23. The document printing system of claim 22, wherein: 
the control system is further for: 

preventing printing by the first print head until an appropriate signal 
is generated by the second print head. 
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24. The document printing system of claim 23, wherein: 
the control system is further for: 

initiating a mutual authentication routine between the second print 

head and the authentication unit; and 
preventing printing by the second print head if the mutual 

authentication is unsuccessful. 

25. A method of operating a document printing system to print a document 
having non-authentication data, the method comprising the step(s) of: 

executing a transaction session between a computer and an 

authentication unit to generate content data to be included in the 
document; 

transmitting a print request to a printer to print the document, the printer 

including an unsecure print head and a secure print head; 
printing the content data with the unsecure print head; and 
printing forensic evidence of the authenticity of the postal indicia with the 
secure print head. 

26. The method of claim 25, wherein: 

the document further includes authorization data; and 
the forensic evidence of the authenticity of the postal indicia is the 
authorization data. 

27. The method of claim 26, further comprising the step(s) of: 
preventing printing by the first print head until an appropriate signal is 

generated by the second print head. 

28. The method of claim 27, further comprising the step(s) of: 

initiating a mutual authentication routine between the second print head 
and the authentication unit; and 
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preventing printing by the second print head if the mutual authentication is 
unsuccessful. 



29. The method of claim 25, wherein: 

the document further includes authorization data printed by the unsecure 
print head; and 

the forensic evidence of the authenticity of the document is a unique print 
pattern. 

30. The method of claim 29, wherein: 

the unique print pattern is a tell that is embedded within the document. 

31 . The method of claim 30, further comprising the step(s) of: 
preventing printing by the first print head until an appropriate signal is 

generated by the second print head. 

32. The method of claim 31 , further comprising the step(s) of: 

initiating a mutual authentication routine between the second print head 

and the authentication unit; and 
preventing printing by the second print head if the mutual authentication is 

unsuccessful. 
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POSTAGE METERING SYSTEM INCLUDING 
A PRINTER HAVING DUAL PRINT HEADS 



F-211 



ABSTRACT OF THE INVENTION 

A postage metering system includes a computer, an authentication unit, a 
printer and a control system. The control system is in operative communication 
with the computer, the authentication unit and the printer. The authentication 
unit and the printer are both in operative communication with the computer. The 
printer includes an unsecure print head and a secure print head. The control 
system: (i) executes a transaction session between the computer and the 
authentication unit to generate postal data to be included in a postal indicium 
where the postal indicium includes non-authorization data; (ii) initiates a print 
request to print the postal indicium; and (iii) controls the unsecure print head to 
print the non-authorization data and the secure print head to print forensic 
evidence of the authenticity of the postal indicium. 
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inventor's certificate issued before the date of this application in any country foreign to the 
United States of America on an application filed by me or my legal representatives or assigns 
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of America prior to this application by me or my legal representatives or assigns. 
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